# CVE-2025-54070: OpenZeppelin Contracts out-of-bounds memory access in Bytes.lastIndexOf

Source: https://junglewise.ai/threats/cve-2025-54070-openzeppelin-contracts-out-of-bounds-memory-access-in-bytes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-54070 · Severity: low · CVSS 3.1 · Published 2025-07-17

OpenZeppelin Contracts is a widely-used library providing secure, audited smart contract components for blockchain applications. The Bytes library's lastIndexOf function contains a memory safety flaw that can read outside buffer boundaries when processing empty buffers with certain position arguments. This could cause applications to receive invalid memory values, leading to unexpected behavior, denial of service through out-of-gas conditions, or logic errors in dependent code that doesn't validate returned indices.

Technologies: [@openzeppelin/contracts (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts), [@openzeppelin/contracts-upgradeable (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts-upgradeable), [OpenZeppelin Contracts](https://junglewise.ai/threats/technologies/contracts), [OpenZeppelin Contracts Upgradeable](https://junglewise.ai/threats/technologies/contracts-upgradeable). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OpenZeppelin](https://junglewise.ai/threats/vendors/openzeppelin).

## Quick answers

**Is CVE-2025-54070 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-54070 being exploited in the wild.

**How severe is CVE-2025-54070?** Low severity, with a CVSS score of 3.1, published 17 July 2025.

**Which products and versions are affected?** @openzeppelin/contracts (npm) SEMVER:introduced=5.2.0,fixed=5.4.0; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=5.2.0,fixed=5.4.0; OpenZeppelin Contracts 5.2.0–5.3.x; OpenZeppelin Contracts Upgradeable 5.2.0–5.3.x.

**Is there a fix for CVE-2025-54070?** Yes. @openzeppelin/contracts (npm): upgrade to 5.4.0 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 5.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-54070 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-54070?** Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openzeppelin/contracts (npm): upgrade to 5.4.0 or later

  ```sh
  npm install @openzeppelin/contracts@5.4.0
  ```

- @openzeppelin/contracts-upgradeable (npm): upgrade to 5.4.0 or later

  ```sh
  npm install @openzeppelin/contracts-upgradeable@5.4.0
  ```


## Technical details

The vulnerability is a bounded out-of-bounds memory read (CWE-125) in the lastIndexOf(bytes,byte,uint256) function within Solidity's Bytes library. When the buffer is empty (length == 0) and the position argument is not type(uint256).max, the function accesses uninitialized memory at offset buffer + 0x20 + pos instead of returning the expected sentinel value. If memory at that location matches the search byte pattern, the function returns an invalid index pointing outside the buffer bounds, rather than type(uint256).max as documented. Callers that use the returned index for subsequent memory access without bounds checking could trigger reverts or undefined behavior. The vulnerability affects versions 5.2.0 through 5.3.x and is fixed in version 5.4.0.

## Affected products

- OpenZeppelin Contracts 5.2.0–5.3.x
- OpenZeppelin Contracts Upgradeable 5.2.0–5.3.x

## Identifiers

- CVE-2025-54070
- GHSA-9rcw-c2f9-2j55

## Timeline

- 2025-07-17: disclosed
- 2025-07-17: patched: Fixed in version 5.4.0

## References

- [https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9rcw-c2f9-2j55](https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9rcw-c2f9-2j55)

## Related threats

- [OpenZeppelin Contracts information disclosure in VestingWalletConfidential](https://junglewise.ai/threats/openzeppelin-confidential-contracts-vestingwalletconfidential-a-14aa72cf)
- [OpenZeppelin Contracts base64 encoding reads from dirty memory](https://junglewise.ai/threats/cve-2024-27094-openzeppelin-contracts-base64-encoding-reads-from-dirty-memory)
- [OpenZeppelin Contracts duplicated execution in Multicall](https://junglewise.ai/threats/cve-2023-49798-openzeppelin-contracts-duplicated-execution-in-multicall)
- [OpenZeppelin Contracts improper escaping in ERC2771Context](https://junglewise.ai/threats/cve-2023-40014-openzeppelin-contracts-improper-escaping-in-erc2771context)
- [OpenZeppelin Contracts MerkleProof multiproof verification bypass](https://junglewise.ai/threats/cve-2023-34459-openzeppelin-contracts-merkleproof-multiproof-verification-bypass)